Albin Kerouanton
cbc2a71c27
libnet/d/bridge: Don't set container's gateway when network is internal
...
So far, internal networks were only isolated from the host by iptables
DROP rules. As a consequence, outbound connections from containers would
timeout instead of being "rejected" through an immediate ICMP dest/port
unreachable, a TCP RST or a failing `connect` syscall.
This was visible when internal containers were trying to resolve a
domain that don't match any container on the same network (be it a truly
"external" domain, or a container that don't exist/is dead). In that
case, the embedded resolver would try to forward DNS queries for the
different values of resolv.conf `search` option, making DNS resolution
slow to return an error, and the slowness being exacerbated by some libc
implementations.
This change makes `connect` syscall to return ENETUNREACH, and thus
solves the broader issue of failing fast when external connections are
attempted.
Signed-off-by: Albin Kerouanton <albinker@gmail.com >
2023-10-09 13:57:54 +02:00
..
2020-02-11 00:06:42 +01:00
2023-07-13 13:37:26 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2022-05-19 10:54:31 +02:00
2019-10-09 21:44:22 +02:00
2023-09-07 18:38:22 +00:00
2023-09-11 15:30:44 +02:00
2019-09-09 21:06:12 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-15 10:07:29 +02:00
2023-05-19 20:38:51 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-12 10:40:13 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-12 10:40:13 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-05-19 20:38:51 +02:00
2023-09-08 09:47:56 +02:00
2023-06-29 00:08:27 +02:00
2023-09-29 13:57:48 +02:00
2023-09-07 18:38:22 +00:00
2023-06-29 00:08:27 +02:00
2023-09-07 18:38:22 +00:00
2022-09-27 22:15:19 +02:00
2023-05-19 20:38:51 +02:00
2023-06-29 00:08:27 +02:00
2023-09-07 18:38:22 +00:00
2023-05-19 20:38:51 +02:00
2023-10-04 15:59:30 +02:00
2023-09-07 18:38:22 +00:00
2023-08-31 09:36:48 +02:00
2023-09-07 18:38:22 +00:00
2023-05-19 20:38:51 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-10-09 13:57:54 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2022-06-17 10:59:04 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-08-31 09:36:48 +02:00
2023-09-07 18:38:22 +00:00
2023-09-27 13:57:48 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-08 12:08:35 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-25 17:22:28 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-12 10:40:13 +02:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2022-06-17 10:59:04 +02:00
2023-09-07 18:38:22 +00:00
2023-09-11 16:39:29 +02:00
2021-08-27 14:56:57 +08:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-06-24 00:23:44 +00:00
2023-09-07 18:38:22 +00:00
2023-09-07 18:38:22 +00:00
2023-09-18 15:34:20 +02:00
2023-09-07 18:38:22 +00:00
2023-06-26 11:18:09 +02:00
2023-05-19 20:38:51 +02:00
2023-05-19 20:38:51 +02:00
2023-06-26 11:18:09 +02:00
2023-05-19 20:38:51 +02:00
2022-11-29 17:02:53 +01:00